description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\InetHelper\\cleaner.exe\""	wns4E40.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\InetHelper\\cleaner.exe\""	cleaner.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wns4E40.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\InetHelper = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\InetHelper\\cleaner.exe\""	wns4E40.tmp

resource	yara_rule
behavioral3/files/0x001900000002ab13-26.dat	upx
behavioral3/memory/1988-27-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-33-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-36-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-38-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-40-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-43-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-46-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-50-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-53-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-57-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-61-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-64-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-65-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-68-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-71-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-74-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-78-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-82-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-85-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-86-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-89-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-92-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-95-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-99-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-102-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-106-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-110-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-113-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-117-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx
behavioral3/memory/1988-120-0x0000000000400000-0x0000000001F1A000-memory.dmp	upx

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\cleaninethelper = "rundll32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wsc3F99.tmp\",Start verpostfix=bt"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\InetHelper = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\InetHelper\\cleaner.exe\""	wns4E40.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\InetHelper = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\InetHelper\\cleaner.exe\""	cleaner.exe

description	ioc	Process
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\FLEngine_x64.dll	run.exe
File opened for modification	C:\Program Files\Image-Line	run.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 20	run.exe
File created	C:\Program Files\Image-Line\FL Studio 20\__tmp_rar_sfx_access_check_240600078	run.exe
File created	C:\Program Files\Image-Line\FL Studio 20\FL64.exe	run.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 20\FL64.exe	run.exe
File created	C:\Program Files\Image-Line\FL Studio 20\FLEngine_x64.dll	run.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1364	wmic.exe
Token: SeSecurityPrivilege	1364	wmic.exe
Token: SeTakeOwnershipPrivilege	1364	wmic.exe
Token: SeLoadDriverPrivilege	1364	wmic.exe
Token: SeSystemProfilePrivilege	1364	wmic.exe
Token: SeSystemtimePrivilege	1364	wmic.exe
Token: SeProfSingleProcessPrivilege	1364	wmic.exe
Token: SeIncBasePriorityPrivilege	1364	wmic.exe
Token: SeCreatePagefilePrivilege	1364	wmic.exe
Token: SeBackupPrivilege	1364	wmic.exe
Token: SeRestorePrivilege	1364	wmic.exe
Token: SeShutdownPrivilege	1364	wmic.exe
Token: SeDebugPrivilege	1364	wmic.exe
Token: SeSystemEnvironmentPrivilege	1364	wmic.exe
Token: SeRemoteShutdownPrivilege	1364	wmic.exe
Token: SeUndockPrivilege	1364	wmic.exe
Token: SeManageVolumePrivilege	1364	wmic.exe
Token: 33	1364	wmic.exe
Token: 34	1364	wmic.exe
Token: 35	1364	wmic.exe
Token: 36	1364	wmic.exe
Token: SeIncreaseQuotaPrivilege	1364	wmic.exe
Token: SeSecurityPrivilege	1364	wmic.exe
Token: SeTakeOwnershipPrivilege	1364	wmic.exe
Token: SeLoadDriverPrivilege	1364	wmic.exe
Token: SeSystemProfilePrivilege	1364	wmic.exe
Token: SeSystemtimePrivilege	1364	wmic.exe
Token: SeProfSingleProcessPrivilege	1364	wmic.exe
Token: SeIncBasePriorityPrivilege	1364	wmic.exe
Token: SeCreatePagefilePrivilege	1364	wmic.exe
Token: SeBackupPrivilege	1364	wmic.exe
Token: SeRestorePrivilege	1364	wmic.exe
Token: SeShutdownPrivilege	1364	wmic.exe
Token: SeDebugPrivilege	1364	wmic.exe
Token: SeSystemEnvironmentPrivilege	1364	wmic.exe
Token: SeRemoteShutdownPrivilege	1364	wmic.exe
Token: SeUndockPrivilege	1364	wmic.exe
Token: SeManageVolumePrivilege	1364	wmic.exe
Token: 33	1364	wmic.exe
Token: 34	1364	wmic.exe
Token: 35	1364	wmic.exe
Token: 36	1364	wmic.exe
Token: SeIncreaseQuotaPrivilege	2108	wmic.exe
Token: SeSecurityPrivilege	2108	wmic.exe
Token: SeTakeOwnershipPrivilege	2108	wmic.exe
Token: SeLoadDriverPrivilege	2108	wmic.exe
Token: SeSystemProfilePrivilege	2108	wmic.exe
Token: SeSystemtimePrivilege	2108	wmic.exe
Token: SeProfSingleProcessPrivilege	2108	wmic.exe
Token: SeIncBasePriorityPrivilege	2108	wmic.exe
Token: SeCreatePagefilePrivilege	2108	wmic.exe
Token: SeBackupPrivilege	2108	wmic.exe
Token: SeRestorePrivilege	2108	wmic.exe
Token: SeShutdownPrivilege	2108	wmic.exe
Token: SeDebugPrivilege	2108	wmic.exe
Token: SeSystemEnvironmentPrivilege	2108	wmic.exe
Token: SeRemoteShutdownPrivilege	2108	wmic.exe
Token: SeUndockPrivilege	2108	wmic.exe
Token: SeManageVolumePrivilege	2108	wmic.exe
Token: 33	2108	wmic.exe
Token: 34	2108	wmic.exe
Token: 35	2108	wmic.exe
Token: 36	2108	wmic.exe
Token: SeIncreaseQuotaPrivilege	2108	wmic.exe

description	pid	Process	procid_target
PID 2228 wrote to memory of 3596	2228	Replace.exe	80
PID 2228 wrote to memory of 3596	2228	Replace.exe	80
PID 2228 wrote to memory of 3596	2228	Replace.exe	80
PID 2228 wrote to memory of 3980	2228	Replace.exe	81
PID 2228 wrote to memory of 3980	2228	Replace.exe	81
PID 3596 wrote to memory of 3156	3596	rundll32.exe	83
PID 3596 wrote to memory of 3156	3596	rundll32.exe	83
PID 3596 wrote to memory of 3156	3596	rundll32.exe	83
PID 3156 wrote to memory of 1308	3156	wns4E40.tmp	84
PID 3156 wrote to memory of 1308	3156	wns4E40.tmp	84
PID 3156 wrote to memory of 1308	3156	wns4E40.tmp	84
PID 1308 wrote to memory of 1988	1308	cleaner.exe	85
PID 1308 wrote to memory of 1988	1308	cleaner.exe	85
PID 1308 wrote to memory of 1988	1308	cleaner.exe	85
PID 1988 wrote to memory of 1364	1988	node.exe	86
PID 1988 wrote to memory of 1364	1988	node.exe	86
PID 1988 wrote to memory of 1364	1988	node.exe	86
PID 1988 wrote to memory of 2108	1988	node.exe	89
PID 1988 wrote to memory of 2108	1988	node.exe	89
PID 1988 wrote to memory of 2108	1988	node.exe	89
PID 1988 wrote to memory of 3512	1988	node.exe	91
PID 1988 wrote to memory of 3512	1988	node.exe	91
PID 1988 wrote to memory of 3512	1988	node.exe	91
PID 1988 wrote to memory of 5108	1988	node.exe	93
PID 1988 wrote to memory of 5108	1988	node.exe	93
PID 1988 wrote to memory of 5108	1988	node.exe	93
PID 1988 wrote to memory of 2788	1988	node.exe	95
PID 1988 wrote to memory of 2788	1988	node.exe	95
PID 1988 wrote to memory of 2788	1988	node.exe	95
PID 1988 wrote to memory of 4648	1988	node.exe	97
PID 1988 wrote to memory of 4648	1988	node.exe	97
PID 1988 wrote to memory of 4648	1988	node.exe	97
PID 1988 wrote to memory of 2852	1988	node.exe	99
PID 1988 wrote to memory of 2852	1988	node.exe	99
PID 1988 wrote to memory of 2852	1988	node.exe	99
PID 1988 wrote to memory of 1036	1988	node.exe	101
PID 1988 wrote to memory of 1036	1988	node.exe	101
PID 1988 wrote to memory of 1036	1988	node.exe	101
PID 1988 wrote to memory of 4976	1988	node.exe	103
PID 1988 wrote to memory of 4976	1988	node.exe	103
PID 1988 wrote to memory of 4976	1988	node.exe	103
PID 1988 wrote to memory of 2904	1988	node.exe	105
PID 1988 wrote to memory of 2904	1988	node.exe	105
PID 1988 wrote to memory of 2904	1988	node.exe	105
PID 1988 wrote to memory of 2348	1988	node.exe	107
PID 1988 wrote to memory of 2348	1988	node.exe	107
PID 1988 wrote to memory of 2348	1988	node.exe	107
PID 1988 wrote to memory of 1616	1988	node.exe	109
PID 1988 wrote to memory of 1616	1988	node.exe	109
PID 1988 wrote to memory of 1616	1988	node.exe	109
PID 1988 wrote to memory of 4964	1988	node.exe	111
PID 1988 wrote to memory of 4964	1988	node.exe	111
PID 1988 wrote to memory of 4964	1988	node.exe	111
PID 1988 wrote to memory of 4820	1988	node.exe	113
PID 1988 wrote to memory of 4820	1988	node.exe	113
PID 1988 wrote to memory of 4820	1988	node.exe	113
PID 1988 wrote to memory of 2920	1988	node.exe	115
PID 1988 wrote to memory of 2920	1988	node.exe	115
PID 1988 wrote to memory of 2920	1988	node.exe	115
PID 1988 wrote to memory of 2316	1988	node.exe	117
PID 1988 wrote to memory of 2316	1988	node.exe	117
PID 1988 wrote to memory of 2316	1988	node.exe	117
PID 1988 wrote to memory of 3108	1988	node.exe	119
PID 1988 wrote to memory of 3108	1988	node.exe	119

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads